Always Install Elevated Windows Installer — Detection Rule

Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege

Read the full analysis on IntelFusions